CFCA self-reported cross-signed certificate missing required EKU extension; incident report closed after final call for comments
CFCA reported that a cross-signed certificate issued from a multipurpose root to a dedicated TLS root was missing the required Extended Key Usage (EKU) extension under CCADB Policy Section 6.3. The issue was identified by CFCA during an internal compliance review, so the case is a self-reported incident rather than an externally filed complaint. CFCA said the affected cross-signed certificate was revoked on 2026-08-31 and that issuance from the dedicated root was stopped while the scope was being assessed. CFCA later stated that all action items were completed, including establishing a documented process for determining cross-certificate profile attributes and incorporating the applicable CCADB and root program requirements into the certificate profile. On 2026-09-24, CCADB issued a final call for comments and said the report would be closed around 2026-10-01 if there were no further questions; the bug is now resolved.
- CFCA issued a cross-signed certificate without the EKU extension required for the dedicated root hierarchy.
- CFCA identified the missing EKU extension during an internal compliance review.
- CFCA revoked the non-compliant cross-signed certificate.
- CFCA completed the listed action items for revocation and process updates.
- CCADB posted a final call for comments on the incident report.
- China Financial Certification Authority (CFCA) — CFCA filed a preliminary incident report saying the cross-signed certificate lacked the required EKU extension and marked the disclosure as self-reported.
- China Financial Certification Authority (CFCA) — CFCA posted the full incident report with the timeline, impact, revocation date, and related incidents.
- China Financial Certification Authority (CFCA) — CFCA said it was monitoring the bug and had no further updates yet.
- China Financial Certification Authority (CFCA) — CFCA said the CPR action item was completed and that all action items were done, with the action-items table updated to Completed.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-10-01 if there were no further questions.